Chrome Web Store Team complains a Violation: My Extension (Cancelly.ca) is injecting the enterprise.js

TL;DR

Fix: in SDK v10.8.0 or later, import from the firebase/auth/web-extension endpoint instead of firebase/auth. Chrome Web Store flags Firebase's enterprise.js in extension builds because the default firebase/auth import pulls in reCAPTCHA Enterprise code.

Steps

1. Chrome Web Store flags Firebase's enterprise.js in extension builds because the default firebase/auth import pulls in reCAPTCHA Enterprise code. Fix: in SDK v10.8.0 or later, import from the firebase/auth/web-extension endpoint instead of firebase/auth. Note the endpoint doesn't support popup/redirect operations, phone auth with reCAPTCHA, SMS multi-factor with reCAPTCHA, or reCAPTCHA Enterprise; for those, use offscreen documents instead.

When to use

You are seeing this: Reported in Firebase: Chrome Web Store Team complains a Violation: My Extension (Cancelly.ca) is injecting the enterprise.js externally.... Use this skill when you run into "Chrome Web Store Team complains a Violation: My Extension (Cancelly.ca) is injecting the enterprise.js".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: SDK v10.8.0. If you are on something much newer or older, the details may have shifted.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Edge cases

• Note the endpoint doesn't support popup/redirect operations, phone auth with reCAPTCHA, SMS multi-factor with reCAPTCHA, or reCAPTCHA Enterprise; for those, use offscreen documents instead.

In gh:firebase/firebase-js-sdk#7617 (https://github.com/firebase/firebase-js-sdk/issues/7617), the reporter ran into this: Reported in Firebase: Chrome Web Store Team complains a Violation: My Extension (Cancelly.ca) is injecting the enterprise.js externally.... The verified resolution: Chrome Web Store flags Firebase's enterprise.js in extension builds because the default firebase/auth import pulls in reCAPTCHA Enterprise code. Fix: in SDK v10.8.0 or later, import from the firebase/auth/web-extension endpoint instead of firebase/auth. Note the endpoint doesn't support popup/redirect operations, phone auth with reCAPTCHA, SMS multi-factor with reCAPTCHA, or reCAPTCHA Enterprise; for those, use offscreen documents instead.